changed ensure_current_user to require_login