login persists off of login page. No login posted to URL if email/password match isn't found