allow login via js request