login controller now supports login/pass auth