validation rules in controller