fix bugs, deny create post for non-logined user