redirect to login when auth is removed