add passport auth to GET all users