returning user object, logging in