when detecting a login form, explicitly check the action URL