user param in /login, not username