add authentication route if not logged in