remove loginUrl from expected signed request post