Esp8266 async webserver redirect problem

Hi, I am new in async webserver programming. I have a webpage with a index page and a system page. so far so good, that works like a charm. Now, I like to protect the systempage with a password. So I added a extra loginpage. But if I test the incomming arguments, that works, I see the password, but the new route to the webpage doesn’t come. Where did I make a mistake?

*************** code in esp8266 ***************

server.on("/login", HTTP_GET, [](AsyncWebServerRequest *request){    

    if (request->hasParam("pw")) {
      String pasw = request->getParam("pw")->value();
      Serial.println(pasw);
      Serial.println(sitepasw);
      if(pasw==sitepasw){                                                            // test incomming password
              request->send(SPIFFS, "/upload.html", String(), false);  // <= not working !!!!!
      }
      else{    
        request->send(SPIFFS, "/login.html", String(), false); 
      } 
    }
    else{    
        request->send(SPIFFS, "/login.html", String(), false);          // <= this is working
    }    
  });

******************website ************

<!DOCTYPE html>
<html>
  <head>
    <meta http-equiv="content-type" content="text/html; charset=utf-8">
    <meta name="viewport" content="width=device-width,initial-scale=1">
    <title>Water irrigatie</title>
    <link rel="stylesheet" type="text/css" href="style.css">
  </head>
  <body>
    <section class="main">
      <div id="logo">
        <h2 for="nav-toggle-cb" id="nav-toggle">System login - Water
          Irigatie <span id="proc"></span></h2>
      </div>
      <div id="content">
        <div id="sidebar"> <input id="nav-toggle-cb" checked="checked" type="checkbox">
          <nav id="menu">
            <div> <label>Paswoord : </label> <input id="pasw" type="password">
              <input value="Send" onclick="sendpasw()" type="button"> </div>
          </nav>
        </div>
      </div>
    </section>
    <script>


function sendpasw(element) {      /* als men op pomp schakelaar drukt*/
  var xhr = new XMLHttpRequest();
  var tekst;

   if (document.getElementById("pasw").value != "") {
          tekst = "/login?pw=" + document.getElementById('pasw').value;
        }
   else{
       tekst = "/login"
    }

    xhr.open("GET", tekst , true);
    xhr.send();
  
}



</script>
  </body>
</html>