proof of concept works -- forwards to HMS login