Require authorization on API controllers.