add auth for viewing appointments