adds server side validation, corrects client deleting items before server returns, adds 400 header for bad requests