added login widget

need to not have password posted to url