Expose authentication as routes

- expose routes to be mounted by mountSubApiRoute in the app-maker
- to-do: use express 4 router