slowly adding authorization to each route where it's needed