refactor login, remove client encryption