more strict checking on login/session url