we can login to a drupal site by http://www.example.com/?q=user when the login block has been hidden.