access to /login is now enforced via SSL