fix SettingsController to require login