login/post: require user to access