add authorization functions; add authoriztation requirement to routes