fixed possible exploit, backend checks is_tippable now