add user and group route authentication