renamed route to users/validate