authenticated api and fetch from mongo