fixed authorization through html /users/login