auth route returns a token
lock down all api routes to require a token