Login should check objectId, too