If we are authenticated, then authorize. Issue #2

I couldn't access to anything but static/api...
Return true in 'authorize' if context.req.session.user is set (which is
done in 'authenticate') seems to fix the problem.