bug: not redirecting when not logged in