This one may be a different case than the URL check was. There are two possible cases that I wanted to be able to catch:

1) The user provided a username, but no password. The username validation will notice this.
2) The user provided a password, but no username. The password validation will notice this.

Does that make sense of why they both check that the other is set?

Another way I could do this is to have the username validation require itself if the password is set, as well as require the password if itself is set. It's still two checks, but they could be in the same method. I put them in separate methods, but there's no reason they couldn't be in one. Would you prefer that?