server-side validation
secured password