diff --git a/heymans/__init__.py b/heymans/__init__.py
index 4ab5ef9..d0e3e47 100644
--- a/heymans/__init__.py
+++ b/heymans/__init__.py
@@ -1,3 +1,3 @@
 """AI-based chatbot that provides sensible answers based on documentation"""
 
-__version__ = '0.13.1'
+__version__ = '0.13.2'
diff --git a/heymans/config.py b/heymans/config.py
index 95967fd..8b38723 100644
--- a/heymans/config.py
+++ b/heymans/config.py
@@ -186,14 +186,28 @@ def process_ai_message(msg):
 
 def validate_user(username, password):
     """user_validation.validate() should connect to an authentication system
-    that verifies the account. Whitespace has been stripped from both the
-    username and the password. The username is converted to lowercase.
+    that verifies the account. 
+    
+    Parameters
+    ----------
+    username : str
+        Lowercase. Whitespace has been stripped.
+    password : str
+        Whitespace has been stripped.
+        
+    Returns
+    -------
+    str or None:
+        If the user is validated, the username is returned. This is typically
+        equal to the `username` parameter, but in some cases it may differ, for
+        example if the user logs in with an email address instead of the actual
+        username. If the user is not validated, None is returned.
     """
     try:
         import user_validation
     except ImportError:
         logger.info('no user validation script found')
-        return True
+        return username
     logger.info('using validation script')
     return user_validation.validate(username, password)
 
diff --git a/heymans/routes/app.py b/heymans/routes/app.py
index 047004e..f804b52 100644
--- a/heymans/routes/app.py
+++ b/heymans/routes/app.py
@@ -79,7 +79,8 @@ def login_handler(form, failed=False):
     if form.validate_on_submit():
         username = form.username.data.strip().lower()
         password = form.password.data.strip()
-        if not config.validate_user(username, password):
+        username = config.validate_user(username, password)
+        if username is None:
             return redirect('/login_failed')
         kdf = PBKDF2HMAC(algorithm=hashes.SHA256(),
                          length=32,