basic authorization for API course routes