api: fix in user resource auth checking