ensure user session is resolved in all protected routes