prevent going to routes that require login