Avoiding npe by checking url returned by authenticator