Anon login via xhr does not redirect