moved login and register functions from user to api controller