Login is still a controller, but externalized