redirect /login when user is not logged in