move require_login filter to app controller