login handler JSON vulnerability protection
redirect /login handler
typos