cleaned up device code a tiny bit + made user an optional query param for /login