adding authorization to PUT and DEL routes