I want to make sure that when you go to the addresses /admin-cp or its subpages /admin-cp/analytics or /admin-cp/users, access is checked and the corresponding page is displayed.

I did that when switching to /admin-cp opened loader.html with a js code that throws a request to the server with a token:

async function loadEdit(user) {
  const idToken = await user.getIdToken()
  const res = await fetch('/admin-cp/analytics',  { headers: { authorization: idToken },  redirect: 'follow' })
  /*.then(res => {
    if (res.redirected) {
        document.location = res.url;
    }
  })*/
  console.log(res);
  return res;
}

And the server checked the token and displayed the desired page:

app.get("/admin-cp", function (req, res) {
    res.sendFile(path.join(initial_path, "admin-cp/loader.html"));
});

app.get("/admin-cp/:page", function (req, res) {
    const idToken = req.headers.authorization;
    if (!idToken) return res.status(401).send("Unauthorized")

    const sessionCookie = req.cookies.session || "";
    
    admin
        .auth()
        .verifySessionCookie(sessionCookie, true  )
        .then((userData) => {
            console.log("Logged in:", userData.email)
            console.log('Авторизован. Доступ в админ панель открыт')


            admin
            .auth()
            .verifyIdToken(idToken)
            .then((claims) => 
            {  
                if (claims.admin === true) 
                {    
                    console.log('Зашёл с правами администратора', req.params.page);
                    if (req.params.page === 'analytics')
                    {
                        console.log("Open analytics");
                        res.sendFile(path.join(initial_path, "admin-cp/main-admin_cp.html"));
                    }
                } 
                else if (claims.admin === false)
                {
                    console.log('Зашёл без прав администратора');
                    res.sendFile(path.join(initial_path, "admin-cp/global_not_permission.html"));
                }
            });
            
            
        })
        .catch((error) => {
            console.log('Не авторизован. Ошибка', error, ' отсутвует userData')
            res.redirect("/login");
        });

});

But nothing happens. The token is verified, but the page is not displayed.