base auth model, login controller