refactor User.login with a better understanding of Promises