api: /users/login must be defined before /users/:id
frontend: login page & controller, auth service, auth  interceptor
api & frontend: make sure user is logged in before using app