new `authorized` decorator, replace bottle auth plugin