fix non private routes
login route requires non-logged-in users