Issue 1: Security.login and logout shall allow POST only