Require auth for /departures & /schedule endpoints
with stubbed out responses if 'Authorization' request header is missing
Enable CORS