working login api, wip