fix #20 password-less login