POST /api/user
complete login