have a bug in login which user is not defined