add auth module; auth before filter