create user works and redirects
session-based login works