“The login page is not part of the audit scope.”