require login before using api