ensure authenticated for all apis