Fix: login_check URL must not be publically accessible