it should be `authorize_proxy_routes` as the authentication (finding out who is the user accessing the route) was already done, this is checking, if the user is allowed to do the stuff: authoroization