make lists require auth