login - POST to /api/login is working