auth, separate public and protected