created auth function
removed auth logic from route