tweaked route to force login