a bit more robust login
logging in should only return state
login doesn't persist between Shpiders