user validation scheme