Fix log statement, require auth for starring