redir to root if login needed