add auth middleware, passport.js