authorization strategy added, now we can protect a rest endpoint