add before filter to check authentication