changed some code in login method to test csrf protection