added redirect and moved validation to middleware