Login headers filter now uses LoginModel not auth class directly