login user on fronted (including via API)