Use login_required instead of manual verification