allow login from any domain with redirect

Prevent redirect loop for private by pin