added error logic to login route, fixed query