make sure user is logged in