implement authorization check in API, resolve #170