api - hasAuthorization and isAdmin middleware