only allow viewing the root page without being logged in