Wrap /user/{username} in RequireAuth middleware (closes #60)

internal/handlers/profile.go

@@ -17,11 +17,13 @@ func (h *Handlers) HandleProfile() http.HandlerFunc {
 			return
 		}
 
-		// Get session
+		// Get session. RequireAuth middleware guarantees an
+		// authenticated session before this handler runs, so we
+		// only need to guard against an unexpected retrieval error.
 		sess, err := h.session.Get(r)
-		if err != nil || !h.session.IsAuthenticated(sess) {
-			// Redirect to login if not authenticated
-			http.Redirect(w, r, "/pages/login", http.StatusSeeOther)
+		if err != nil {
+			h.log.Error("failed to get session", "error", err)
+			http.Error(w, "Internal server error", http.StatusInternalServerError)
 
 			return
 		}