server-side validation now working