Move auth to backend.py

Move the authorization to backend.py because  pynipap.py is can be
bypassed.