prevent user with no token from accessing the application