need login validation since login_slug depends on that