move iframe build to login callback