userman: disallow protected components if no session/auth done yet