block ability to POST when not logged in