fixed login redirection, password verification