redirect to http if not logged in