simplify userLoggedIn()
mv global var to top
use a middleware to ensure that only logged-in users can access the API