protected most views (requires login)