now just missing server sid validation