Made login service don't use XSRF protection. Still needs to figure out
how to get session cookie from server.