adding /login, taking out Rack::Session::Cookie