added UserController.requiresLogin in routing