subtle but critical bug in google login code