validation in model or controller