change pass to access code, change GET to POST