There is no serverside verification before it sets the tag.

That is probably a bit above your skill level at the moment, but I'm gonna go ahead and recommend you read up on it. If you need some examples I'd be happy to help.