Added authorization checks to api endpoints