Move user validation functions from auth-sessions.lisp to auth-users.lisp