password check
login redirects