added authentication for restricted routes