change login to use HTTP POST