ui routes require authentication