Fix login validation security issue regarding appId check