finally login-on-refresh works