more strict login-check
add more tests