check username and password, redirect if correct