move ensureAuthenticated from app.’s to auth.js.