redirect to login page when the user tries to access a protected url
some refactoring