validate username/password