added middleware: authorization and responses