still try to understand flask-login