login redirect fixed and authorize attr