add logged-in-or-forbidden decorator