now saving userdata in cookies, routing prevents access if user is not logged in