Add auth for user routes