validation in each service, not in the controller