grab user data in root auto method as long as we're logged in, since this will be used virtually everywhere
force app-wide ->secure() so that every redirect will go to https, even when we're proxied across an internal http connection
typo in the form path