Hardcoded login form (haven't csrf protection yet)