more robust login required handling