proper login checking of username/password against 'users' collection (MongoDB)