redirect priverlaged requests to /signin