its login using POST

it's sneaky...