Simple authorization filter; modify booking sample app to use it