restrict login for authenticated users (#10)