login controller flow, ensure user is logged in