server side user validation