user login - some sessions stuff and bcrypt