accept authenticated request only