modules, enforcing invariants on constructors