added an authorization route for the api