add auth check to each action