auth checks for protected pages