fixed redirect on login, fixed directory surfing