protect api routes if not logged in