add auth check to index