login has to be https and include referral