return user._id from POST /login