migrated to express 4; fixed login and login status