add server-side validation