private String validateCredentials(String userid, String password) {
    if (userid == null) {
      return "No userid was specified.";
    }
    if (password == null) {
      return "No password was specified.";
    }

    String loggedOnUserID = sb.getUserid();
    if (loggedOnUserID != null) {
      if (!loggedOnUserID.equals(userid)) {
        return "User '"
            + loggedOnUserID
            + "' is already logged on in this"
            + " browser instance (in another tab or window)."
            + " Only one user logon per browser "
            + " instance is possible. If you wish to view you work"
            + " queued items via your iGoogle Gadget, please "
            + " logout the currently logged on user first.";
      } else sb.setRssAlreadyLoggedOn(true);
    } else {
      if (rm == null) {
        return "Could not connect to work queue, service unavailable.";
      }
      Participant p = rm.getParticipantFromUserID(userid);
      if (p == null) {
        return "Unknown userid: " + userid;
      }
      if (!p.getPassword().equals(password)) {
        return "Incorrect password.";
      }
      if (!rm.hasOrgDataSource()) {
        msgPanel.error(
            "Missing or invalid organisational data source. The resource"
                + " service requires a connection to a valid data source"
                + " that contains organisational data. Please check the"
                + " settings of the 'OrgDataSource' parameter in the service's"
                + " web.xml to ensure a valid data source is set, and/or check"
                + " the configuration properties set for the data source.");
      }
      String handle = rm.login(userid, password, sb.getExternalSessionID());
      if (!rm.successful(handle)) {
        return (msgPanel.format(handle));
      }

      initSession(p, userid, handle);
    }
    return success; // successful login
  }