Add authentication for user rest endpoint
Add 403's to user API endpoints