Fix a security bug

Now you can't go to the staff page without be logged in.