I think it would be useful to have "authorization:admin" or "authorization:user" inside the client routes. Otherwise a user could see the admin interface of a page which doesn't call an API (thus returning the 401 error). It is true that the HTML interface should contain no secrets, but I think it is better not to allow the routing to an admin page to a simple user.