locked down actions if not logged in