improve allowed_to_login