changed input method to POST to prevent password being transmitted by URL