rewritten validation service, moved validation out of controllers into repositories, etc