support login via 3rd party auth, ready to merge