GET method requires login