see description

-login input validation (backend)
-csrf protection