code deduplicate:
- always check password / username input from client