validate user by db