cleaned up login page; still one csrf bug