restrict access to routes on backend based on auth status