client-side validation for login