uses findOne instead of find in controllers/users.js/login