working login check on protected routes & requests