calling 'next' from user.requireLogin only on 200