protip: never trust the client