Add security to the whole API

Restrict access to ressources that are now owned by current user