implemented login check (no session set)