use login form instead of headers to allow non ascci passwords