add client-side validation; get rid of message field since it's apparently never used anywhere (!)