make login controller play nicer (sic)

change POST target to /login
remember username field content in case the user couldn't be logged in