Rewrite the user-login verification logic, add a unit test of one username login more than 1 times.