SECURITY FIX: Don't send credentials as GET params

The login action had the wrong "location" definition for the
parameters. This lead to username and password recorded in server log
files. Now they are changed to "postField" and the server log will just
show the API call with the action.