Lost security fix: protecting /login from forgery