Gail's solution works, but it is similar to closing the barn door after the cow got out. Your application should not have been granted the ability to create logins - that is a serious security flaw :).