users exist, have secure passwords, and are validated