Add login page, don't secure /

Use objectId in bearer token