added another route to show authentication vs authorization, in the demo app