fixed authentication issues - use app.all() to register authentication
middle for all routes starting with /app/