added sanity check for login callback