login validation with password, salt and session