users must be logged in to access everything