working non-google login, needs timestamp checking