add authentication; todo: move authentication to middleware