reworked AuthAction
selected routes to allow, added tests
Finish restrictExternalPurls