require authentication on all pages