when user creates an account, must be kept logged in