adds authorization for all resources

Users can no longer cheat the routes to get to edit forms, etc.