add authorization to the various routes