change login/register params back to payload, remove validate
fixed all test, added username & email to login response