use loggedInUser to prevent infinite redirect when auth'd but not authz'd