login function now uses POST instead of GET