Protect /auth/account with login