fix login: must use secure API URL