GET /schedule now requires authorized user