trying to build logic to handle security (login) process correctly