fix(login): make random login only choose from valid users