fixed big security hole with login and redirct