client-side validation on login/out