add auth filter before manage