working login, show and destroy user api