fix login form - use api session url

There's no non api sessions resource anymore.