redirect to login with optional credentials