add auth to custom action