login handler with rate limit