use login_manager for authentication checking