allow logged in users to access /users page