required for csrf-csrf to correctly protect against
CSRF, as it required the _csrf cookie AND the
x-csrf-token HTTP header, the latter cannot be set
via simple Form POST action
using "../login" here, because "server" method is automatically prepending all paths with "/api",
which we don't want here, as we want "/login"
Panagiotis Papadopoulos
59ecc614c2