with REQUIRES_LOGIN_FOR_ALL_VIEWS config, every view is automatically protected. then a `@no_login` decorator can be used in specific paths See #10