RACK_ENV=development by default
white list for checking authorization
some evaluations routes