validate username and password better