some refactoring of UserController, password is now removed from json object, ui login and signup are on plain pages