Add authorization checks to more routes (instead of ugly cast errors)