put an auth middleware in .before