use middleware.authenticate instead of checking in each fn