redirect only when user is not logged in -- and remember to test PUT requests as well.