feat: replace authentication plugin with access check on the route;