add auth route & function