added auth support - now this.userId avaiable in both the route and the publication