redirect to login page if no auth header found