fixed missing auth checking in some api resources