cater for auth/authz on all req types by introducing a serializer
added test cases