fix backwards login; setup route authorization rules