Use new API for Router.onBeforeAction
Require auth for the right routes