/stats now requires login