login now returns a Player if valid for model