added autorization via a local method to the REST controller

so you don't have to overload the router() method anymore to do you Auth
checks