add auth route middleware