better login, don't prompt with basic auth popup, redirect to front page on 404 from api