add permission checking for /patients
change http response on unathorized to 401