refactored second half of login()