auth now has "requires_login" feature