placed staff.html behind login