move credential validation to UserProvider