user: protect password from other users
route: to initially requested page after signin