redirect to root if it haven't logged in