moved login requirement from base.views to base.urls