There's not much use of creating users if they don't have a way to log back in after logging out. Logging in requires that a user submitted username and password match a username and password stored in the database. If a match is found, we create a session and return that session data to the frontend, else, we end the request with a 401 status code, meaning, authentication was unsuccessful.