must login for new, s route