do not inject js when not logged in