allow only 1 redirect when POSTing login info