refined validation of credentials (app+backend)