add serverside validation