Rearrange routes, add authorize block