nicer messages when requesting a non-existent user/challenge
better is_valid_id function