protect profile page with auth filter