add route and auth funtion