moved validation rules to model - should look into a validation service layer