only ignore routes when there is no user session