login flow

refactoring login flow, and its nearly there

need to figure out how to redirect from a non-requesthandler class