message if login failed, redirect fixes