remove GET/logout route
add basic bearer strategy
bearer strategy with user secret