Can you try running a
server forget and then removing the rewrite file pointer (the web.rewrites.config key) from your server.json file before you start the server again? Your rewrite rules are basically the default
rewritesEnable rules, anyway.
I’m wondering if there’s a parsing issue with the .htaccess file by Tuckey that causing a translated route to be interpreted as static. Also, is there a real absolute path (or mapped path) on your machine to /security/processLogin/ from the root of where the server is starting?