FIX: authorization basics work
ADD: start of secure routes