tweak routes to get tests to pass and add user authentication