redirect to login when user doesn't exist