fixed GET /login route to POST /login