add auth for creating appointments