login route's before() hook