require POST method for login (see #10)