[Backend] add @loginrequired to profile