The url is updating like that because you don't have POST as the form method
<form id="login" method="POST">
However that isn't your main problem. You can have multiple forms on the page if you need to, they just can't be nested and only one can have runat=server. If your forms are not nested then you can use a normal form but you won't be able to use server-side functionality like you do with asp controls. Instead you'll need to use the page_load event and use Request.Form["control
NameHere"] to analyse the values of your form components (note it is the control's name,
not the id you use to reference the control).
If your forms *are* nested then you need to get rid of all but the outer form and wrap your inner group of login controls in an asp:Panel and specify the "DefaultButton" attribute of the panel
<asp:Panel DefaultButton="btnLogin" runat="server">
<asp:TextBox ID="txtUsername" runat="server" />
<asp:Button ID="btnLogin" Text="Login" runat="server" />
</asp:Panel>
That creates a kind of virtual form-within-a-form where if someone presses RETURN on the username box then it will click the Login button allowing you to use btnLogin_Click. This will cause a postback containing the entire form but you just ignore the controls you're not interested in.
So to sum up either use a non-nested non-server form and use Request.Form to read the values from the form elements, or have one server form that has all controls and use Panel\DefaultButton to create a form within a form.