protect api with new auth