--- a/src/pyams_security/views/login.py	Sun Jan 14 14:52:28 2018 +0100
+++ b/src/pyams_security/views/login.py	Wed Mar 07 16:14:12 2018 +0100
@@ -112,6 +112,7 @@
             self.actions['login'].addClass('btn-primary')
 
     def createAndAdd(self, data):
+        data = data.get(self, data)
         principal_id = data.get('principal_id')
         if principal_id is not None:
             headers = remember(self.request, principal_id)
@@ -222,6 +223,7 @@
             self.actions['login'].addClass('btn-primary')
 
     def createAndAdd(self, data):
+        data = data.get(self, data)
         credentials = Credentials('form', id=data['login'], **data)
         manager = query_utility(ISecurityManager)
         if manager is not None:

--- a/src/pyams_security/views/userfolder.py	Sun Jan 14 14:52:28 2018 +0100
+++ b/src/pyams_security/views/userfolder.py	Wed Mar 07 16:14:12 2018 +0100
@@ -176,6 +176,7 @@
             self.actions['confirm'].addClass('btn-primary')
 
     def createAndAdd(self, data):
+        data = data.get(self, data)
         user = data.get('user')
         if user is None:
             raise HTTPNotFound()