auth for get and post