finish refactor to nested routes, only show content belonging to logged in user, force log-in before showing content