require login on all pages & load current_user from session