Made routes restricted by authenticated session.
Now user session is better handled and user resource object sends access token on requests. Login now working.