check if logged in on API route