add auth for canceling appointments