don't allow bearer-only to login