require login for all non-pages actions