How to turn on Autorization?

Question

"By default, an admin-on-rest app doesn’t require authentication".

I have written an application with AOR and Loopback API, etc, and it works well. Except for one thing, I can't turn on turn on authentication. Any username/password will work, just like in the Demo.

From what I can see all required components load, AuthClient etc., Loopback is configured and is waiting for user authorization requests but never gets any.

I copy/pasted a lot of Demo's parts...

Any hints please?

I use the unchanged authClient from kimkha aor loopback

 import storage from './storage';
export const authClient = (loginApiUrl, noAccessPage = '/login') => {
    return (type, params) => {
        if (type === 'AUTH_LOGIN') {
            const request = new Request(loginApiUrl, {
                method: 'POST',
                body: JSON.stringify(params),
                headers: new Headers({ 'Content-Type': 'application/json' }),
            });
            return fetch(request)
                .then(response => {
                    if (response.status < 200 || response.status >= 300) {
                        throw new Error(response.statusText);
                    }
                    return response.json();
                })
                .then(({ ttl, ...data }) => {
                    storage.save('lbtoken', data, ttl);
                });
        }
        if (type === 'AUTH_LOGOUT') {
            storage.remove('lbtoken');
            return Promise.resolve();
        }
        if (type === 'AUTH_ERROR') {
            const { status } = params;
            if (status === 401 || status === 403) {
                storage.remove('lbtoken');
                return Promise.reject();
            }
            return Promise.resolve();
        }
        if (type === 'AUTH_CHECK') {
            const token = storage.load('lbtoken');
            if (token && token.id) {
                return Promise.resolve();
            } else {
                storage.remove('lbtoken');
                return Promise.reject({ redirectTo: noAccessPage });
            }
        }
        return Promise.reject('Unkown method');
    };
};