fixed login to not pass around passwords and turn off csrf exemption