server side validation for querying oneself