moving some logic out of the LoginController to enable the public to write their own login endpoints