changed session.username to username in validate function