Also you need to setup a https endpoint as soon as possible. It's not safe to accept any form of login credentials over the public internet with it.