validation use user_hrn instead of login