removed login restriction on waf/setup