api: require authorization on healer handler

Closes #291.