changed verifyLogin to use XMLHttpRequest header for cookie sending