reworked validation scheme. still uses validate.php, but
all validation happens in there, and every src file includes it.