validate pw for user querying data