add authorization filter to verify incoming media type // fixes #445