split authentication and authorization into seperate methods; removed GuardResponse type; moved common parts of code in API handlers into initHandling; moved authentication and authorization of requests into initHandling