yes, need to create other middleware for auth