new auth view for login required; remove session in decorator if GET value set