check login before all auth-required controllers