changed server api, began working on login with csrf