return data in xml + check userlogin in every function except login