refactor routes to check auth