Do not allow a client to login with a wrong password / salt. Furthermore, check that the provided KeyPair is valid for the user