now also validates whether user in client