add authentication check to create/destroy endpoints.