very basic ogin working. no real security or session