check email and password hash valid