support middleware layer and deny request for some page if user doesn't login yet.