login server must not impersonate the browser when proxying a request