simplify the design, drop login.php for now, it will come back (maybe) at some point...