Secure login with CSRF protection