add passport and auth.js controller
add auth to api routes