add protecetd route for posts, still refactoring tests