split login into two phases