can only login if user exists in db