add auth check to each route url