check for required login on routes