make sure broadcast link is only exposed to logged in users