moved login_required decorator to url