properly logs in and sets cookie to users.id