more changes in the login method to enforce oauth2.0 compliance