control route with authentication