removed client-side validation (this time it's all about the server)