added prevention from redirect loops on bad token