require login for edit endpoint