add authenticate filter to half

- TODO: config User class