profile view: require login (gave 500 without login)