Added CSRF protection to login POST, removed some debug logging