only allow posting if user logged in