rewritten, smarter request route - including new authentication and universal response object