added must login before you access app, and fixed routes