diff --git a/index.php b/index.php
index d7803d0..59a8242 100644
--- a/index.php
+++ b/index.php
@@ -1,5 +1,4 @@
 <?php
-
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
@@ -9,15 +8,19 @@ require_once __DIR__ . "/required.php";
 require_once __DIR__ . "/lib/login.php";
 
 // if we're logged in, we don't need to be here.
-if ($_SESSION['loggedin']) {
+if (!empty($_SESSION['loggedin']) && $_SESSION['loggedin'] === true && !isset($_GET['permissionerror'])) {
     header('Location: app.php');
 }
 
+if (isset($_GET['permissionerror'])) {
+    $alert = lang("no access permission", false);
+}
+
 /* Authenticate user */
 $userpass_ok = false;
 $multiauth = false;
 if (checkLoginServer()) {
-    if ($VARS['progress'] == "1") {
+    if (!empty($VARS['progress']) && $VARS['progress'] == "1") {
         if (!CAPTCHA_ENABLED || (CAPTCHA_ENABLED && verifyCaptcheck($VARS['captcheck_session_code'], $VARS['captcheck_selected_answer'], CAPTCHA_SERVER . "/api.php"))) {
             $errmsg = "";
             if (authenticate_user($VARS['username'], $VARS['password'], $errmsg)) {
@@ -58,7 +61,7 @@ if (checkLoginServer()) {
         } else {
             $alert = lang("captcha error", false);
         }
-    } else if ($VARS['progress'] == "2") {
+    } else if (!empty($VARS['progress']) && $VARS['progress'] == "2") {
         if ($_SESSION['passok'] !== true) {
             // stop logins using only username and authcode
             sendError("Password integrity check failed!");
@@ -114,7 +117,7 @@ header("Link: <static/js/bootstrap.min.js>; rel=preload; as=script", false);
                     <h5 class="card-title"><?php lang("sign in"); ?></h5>
                     <form action="" method="POST">
                         <?php
-                        if (!is_empty($alert)) {
+                        if (!empty($alert)) {
                             ?>
                             <div class="alert alert-danger">
                                 <i class="fa fa-fw fa-exclamation-triangle"></i> <?php echo $alert; ?>
diff --git a/lang/en_us.php b/lang/en_us.php
index 19f44ba..01a42e2 100644
--- a/lang/en_us.php
+++ b/lang/en_us.php
@@ -28,6 +28,7 @@ define("STRINGS", [
     "login server error" => "The login server returned an error: {arg}",
     "login server user data error" => "The login server refused to provide account information.  Try again or contact technical support.",
     "captcha error" => "There was a problem with the CAPTCHA (robot test).  Try again.",
+    "no access permission" => "You do not have permission to access this system.",
     "home" => "Home",
     "point of sale" => "Point of Sale",
     "barcode" => "Barcode",