requiring login for user profile
login doesn't crash if password_hash is empty