/user/login only renders json on post