change API routes to requiring authentication only