feat(auth): login/signup api, but bad