check auth before action