fully functioning login with private (login protected) routes