replace in-memory login with real service backed by db