moved login method to POST instead of GET