authentication protected endpoints are set