middleware to make sure user is logged in