explicit login prompt on protected URL access attempt