fixes #647 headers already sent login broken