Add caveat around POST requests and login timeouts