FIX: API should return post_action or nil, true is wrong
FIX: incorrect redirection code
FIX: missing index
FIX: don't make an ajax request when password or user is blank
SECURITY: stop potential symbol leak