validate password on login