auto authenticated `get` and `post`

except login_url