fixed a security risk with the login form