1st pass on user controller refactoring
fix bug in app.param(login, cb)