login route now sends request to API server