requires authentication catches 403s and redirects