Make authorization.validMatches work as expected.

A small error in routes/auth.js results in tools.isAuthorized() always being called with the second argument undefined, which effectively will validate anyone regardless of the setting of validMatches in the config file.

This PR fixes that.