require users to log in or signup before any other action