add Auth component
restrict access