more server-side validation