add better server-side passability checks