changed ensureAuthenticated to use function expression