defensive for first login experience