minor changes to controllers.js
update Auth factory and app.js to call authorize() before each route