add auth control to some pages