user needs an email address and valid password to be able to log in
password is stored in the database as encrypted, and invalid emails/passwords are not allowed