login w/ post and CORS