fixing refresh bug; implementing login_required middleware