remove all @login_required decorators as complement of r5932
use a middleware to set login_required as a default behavior