api: check for authorization in addLog handler

Closes #288.