Handle login validation in colander

This is a step toward weaning off the horus views.

Close #1660