more auth, login works still not secure