status view is expensive (DB accesses to build statistics), make it logged-in only