small fixes, requiring login on basically all routes, closes #7