users-model: validate email and password