added login_required to all endpoints that should have it