validate credentials