add require_no_current_user helper
restrict routes