Move authentication to application layer
do a render instead redirect when user is not logged in
finish requiring auth for site use