add auth filter to query