users page now requires login