security: after login token is validated, make sure username exists in
the database