routes/user-routes should login with correct credentials and return token