The login page calls /api/user/check, not /api/login.