why we need to check authentication here again? Isn't it getFav api will fail anyway if user is not logged in.