login works... i.e. checks for user and checks their password. Still needs to reject duplicate username.