move is-authenticated? function to api/common