only show header if user logged in