require auth on all requests