login_required using middleware and locals