verify user at each route change