used hash code to submit password as directLogin pattern says. Still no form validation check