authenticates each route where necessary