changed logic to block access to actions that require login