user: add isLoggedIn middleware