better signup flow and proper server-side validation