add requireAuth(): check if valid token was sent
use authorization parser
add GET /mailbox route
add general config file
update spec