I think there is BIG issue with login.
When you log in with valid login and password once then login will always success event when you change login or password to invalid.
Also when you change login and password to valid but for diffrent user then always first user is loged?
How it is possible? Are you remember user by IP?
Can you check this please?