make login necessary for /items/
alter callbackURL for heroku hosting