After 2 hours of debugging finally figured out the login controller is trying to manually set the iframe url... !?