Patient requests are a major security issue

[rodrigogs]

Patient requests are not protected at all, so it could be used to perform DDoS attacks or mainly "cost attacks". My suggestion is to create a magic number that involves a salt from an env variable, and it will be used to "authenticate" patient requests through a new specialized authorizer function.

This is ridiculously critical to implement before lunching.

• Implement authorizer
• Protect patient endpoints
• Implement new security measures in frontend