remove hash from login method

not efficient here because we need to access username and password separately; easier to use params