security setting (redirect to login page if user not authorized