login/post: ignore ?login override for non user admins