login url should be var and not a string