adding login to web api auth