updated /login POST to set cookie