This is actually extremely insecure you need to disable all other login handlers. I can still authenticate from the command line