tighten up login flow