Ensure auth check only on request