loginForm posts to /login/login