Add guidance on how to use validateLoginAttempt

Addresses #1960.