set locals on routes, and require logged in users