login now authenticates with username, pw and role, but commented out till prod