refactor routes so that account page requires authentication