[login] use a form based login