the problem on your page is code order.
Lines 8 - 27 is the Security Assist Authenticate user server behavior, lines 28 - 42 is the coed for the validation.
these two code blocks need to be swapped around so the validation code (lines 28-42) is before the authenticate user code.