coded in very insecure login module... it'll do for now