Add user authorization checks to /scans*