disallow insecure sign in - reopen #458