applying authentication checks to all application routes