adding auth to api routes