fixed small bug with redirect in app.post('/login')