moved authenticate from run to route