invalid login now handled correctly