use the same login validations on sessions and users

The session ones were outdated so valid usernames could not login if they contained a '.'

Refactored so both models use the same module for this validation to ensure consistency.
This should fix the one integration test that fails occasionally.