add naive server-side validation