Move authentication to a Express middleware
Check the requests are authenticated
Implement client credentials
Add resource owner management via URL