add authentication for POST/PUT/DELETE