change authorization path from /user/credentials to GET /authorization

generalize AuthHandler and add a AuthRequiredHandler