add a stateful rewrite to force to login if not authenticated