require auth origin control