require auth to enter app