Issue #14 added auth restrictions for api actions