redirects to login if user is not authenticated