v5.2 refactored login_handler to return user or None