accept POST from /login