auth for /profile endpoint