bug fixed: @auth.requires_login()