use middleware to check logged in