add auth to use route app