prevent bypassing validation using base64