enable auth protection