fix small bugs
  - login is displayed even if the page is not protected.