use POST for login action instead of GET