validate on client side as well