moved validation code to User & Order models, following Codebright trick