bugfix: remember me should be opt-in only