that is fine. It is how user suppose to login to an authenticated area.