validates current user on all pages but root