add server side validation and top-level html5 validation for login