oops, LOGIN_URL and LOGIN_REDIRECT_URL should not be the same....