fixed bug where logged in users sent headers before the next() function