login function should return the XMLHTTPRequest