do not implement the insecure "auto-login" feature