Fixed login issues. forceAuthentication() MUST be called before the request is initiated, or  will contain htmlspecialchars() values.