complete api: signup, login