fixed login logic and logged in user detection