require authentication before adding custom fields (fixes #138)