require authentication on each page