simplify the signin handler, as well as the api routes