fix security flaw -- still prints list after redirect to login page