add client-side security interceptor to redirect to login on invalid session