A user logs in through a login and password form: what happens at that moment, where does the application get the user data and roles?