fixed authorize filter and fixed routes