login works without authorization