use middleware checkAuth for check authorization