adding secret authentication page that can only be seen when user is logged in