Require logged-in user for specified routes