Restricted route access using auth middleware