authorize no camelCase (needed for header parameters)
Use the request instead of the SecurityContext
bundle a (not yet optimized) console dist in webapp