Avoid autologin. User is now logged in when he/she tries to access a private asset