document TODO of the login logic