access check implemented in login controller