added authentication for `POST /locations`