added auth middleware