secure mongoose auth endpoint