requiring authentication for all routes except '/'