fix bug: /external redirect to /login