added route authentication