only user request to login