Switch from GET to POST for login: avoid leaving passwords in logs.