diff --git a/bricks/bricks.js b/bricks/bricks.js
index 75f7fe3..2a50eed 100755
--- a/bricks/bricks.js
+++ b/bricks/bricks.js
@@ -130,6 +130,7 @@ bricks.widgetBuild = async function(desc, widget, data){
 		let opts = desc.options.params || {};
 		var jc = new bricks.HttpJson();
 		var desc1 = await jc.httpcall(url, { "method":method, "params":opts});
+		if (!desc1) return;
 		desc = desc1;
 		klassname = desc.widgettype;
 	}
@@ -464,7 +465,7 @@ bricks.App = class extends bricks.Layout {
 		bricks.bug = opts.debug || false;
 		bricks.Body = this;
 		this.deviceid = bricks.deviceid(opts.appname || 'appname');
-		this.login_url = opts.login_url;
+		this.login_url = opts.login_url || '/rbac/userpassword_login.ui';
 		this.charsize = this.opts.charsize || 20;
 		this.keyevent_blocked = false;
 		this.char_size = this.observable('charsize', this.charsize);
diff --git a/bricks/cols.js b/bricks/cols.js
index 843db02..a7c3544 100644
--- a/bricks/cols.js
+++ b/bricks/cols.js
@@ -97,7 +97,7 @@ bricks.Cols = class extends bricks.VBox {
 		}
 	}
 	async load_first_page(params){
-		var p = bricks.extend({}, this.params);
+		var p = bricks.extend({}, this.data_params);
 		if (params){
 			p = bricks.extend(p, params);
 		}
diff --git a/bricks/jsoncall.js b/bricks/jsoncall.js
index 191a6ec..28a8cba 100755
--- a/bricks/jsoncall.js
+++ b/bricks/jsoncall.js
@@ -121,27 +121,42 @@ bricks.HttpText = class {
 			}
 		}
 		const fetchResult = await fetch(url, _params);
-		var result=null;
-		result = await this.get_result_data(fetchResult);
-		if (fetchResult.ok){
-			var ck =  objget(fetchResult.headers, 'Set-Cookie');
-			if (ck){
-				var session = ck.split(';')[0];
-				bricks.app.save_session(session);
-			}
-			return result;
-		}
+		console.log('fetchResult.status=', fetchResult.status, url, 'login url=', bricks.app.login_url);
 		if (fetchResult.status == 401 && bricks.app.login_url){
+			console.log('go to login')
 			return await this.withLoginInfo(url, _params);
 		}
-		const resp_error = {
-			"type":"Error",
-			"message":result.message || 'Something went wrong',
-			"data":result.data || '',
-			"code":result.code || ''
-		};
-		error.info = resp_error;
-		return error;
+		if (fetchResult.status == 403){
+			var w = new bricks.Error({
+				"title":"access error",
+				"auto_open":true,
+				"message":"you are forbidden to access it",
+				"archor":"cc",
+				"cheight":10,
+				"cwidth":16,
+				"timeout":5
+			});
+			return null;
+		}
+		if (! fetchResult.ok){
+			var w = new bricks.Error({
+				"title":"access error",
+				"auto_open":true,
+				"message":"server return error with error code" + fetchResult.status,
+				"archor":"cc",
+				"cheight":10,
+				"cwidth":16,
+				"timeout":5
+			});
+			return null;
+		}
+		var result = await this.get_result_data(fetchResult);
+		var ck =  objget(fetchResult.headers, 'Set-Cookie');
+		if (ck){
+			var session = ck.split(';')[0];
+			bricks.app.save_session(session);
+		}
+		return result;
 	}
 	async withLoginInfo(url, params){
 		var get_login_info = function(e){
@@ -149,50 +164,13 @@ bricks.HttpText = class {
 			return e.target.getValue();
 		}
 		var w = await bricks.widgetBuild({
-			"id":"login_form",
 			"widgettype":"urlwidget",
 			"options":{
 				"url":bricks.app.login_url
 			}
 		});
-		var login_info = await new Promise((resolve, reject, w) => {
-			w.bind('submit', (event) => {
-				resolve(event.target.getValue());
-				event.target.dismiss();
-			});
-			w.bind('discard', (event) => {
-				resolve(null);
-				event.target.dismiss()
-			});
-		});
-		if (login_info){
-			this.set_authorization_header(params, lgin_info);
-			const fetchResult = await fetch(url, params);
-			var result=null;
-			result = await this.get_result_data(fetchResult);
-			if (fetchResult.ok){
-				return result;
-			}
-			if (fetchResult.status == 401){
-				return await this.withLoginInfo(url, params);
-			}
-		}
-		const resp_error = {
-			"type":"Error",
-			"message":result.message || 'Something went wrong',
-			"data":result.data || '',
-			"code":result.code || ''
-		};
-		const error = new Error();
-		error.info = resp_error;
-		return error;
+		return null;
 	}	
-	set_authorization_header(params, lgin_info){
-		var auth = 'password' + '::' + login_info.user + '::' + login_info.password;
-		var rsa = bricks.app.rsa;
-		var code = rsa.encrypt(auth);
-		self.header.authorization = btoa(code)
-	}
 	async get(url, {headers=null, params=null}={}){
 		return await this.httpcall(url, {
 					method:'GET',