make word stat and user history protected by login_required()