moved data sanitation to app.js