using new SessionController#requireLogin