fix the bug that allowed invalid credentials to still sighn up