custom middleware, authUser

protected url using custom middleware “authUser”