- put validation in routes