add user authentication and routing. add auth check before filter to admin routes