logging in users only if they have correct email/password