require auth across site