validateUser callback needs HTTPStatusEvent as parameter.