Smart api log-in goes to Forbidden page