initial commit with auth middleware