moving authentication out as a importable module for end-users

- users providing custom routes might want to password protect them (e.g., those providing custom views of data, etc...)
- this provides a class-based decorator which can do this