This login request could be refactored to a new method that takes username/userhash and returns a cookie value (or nil if failed)? It is used twice for the initial login and the admin login.