completely redone user/login handling