login method working -- TODO: error handling