cleaned up the routes
set returnErrorCodes to true
stubbed out the middleware for authorization
final tweaks to closes #9, #12 and #13