working auth on /restarant and /protected