fixed login to use POST