account route now requires auth