2.6. Make a new controller that allows a logged-in user to book a room.

- [ ] Endpoints are protected by a login.
- [ ] Endpoints are accessible by the user that is logged-in, the user may only book an available room.
- [ ] You can re-use the code from the login service.
- [ ] API endpoint returns a reasonable error message If the user tries to book a date that is already occupied