TODO rewrite user login