logging the user *in*