//1. Modify this controller to be built by "authRoutes" to protect all it's routes
        /// GET /hello/...
        authRoutes.resource("hello", HelloController(view))

        //2. create the login route
        builder.get("login") { req in
            return try self.view.make("login")
        }

        //3. implement the login logic, built by the "loginRouteBuilder" so our session is persisted
        loginRouteBuilder.post("login") { req in
            guard let email =  req.formURLEncoded?["email"]?.string,
                let password =  req.formURLEncoded?["password"]?.string else {
                    return "Bad credentials"
            }
            let credentials = Password(username: email, password: password)
            let user = try User.authenticate(credentials)

            req.auth.authenticate(user)

            return Response(redirect: "hello")
        }