beefed up login requirements, added param for non-intranet usage