username and password validation, stored in session