moved login to api

fixed cookie saving