+ put [authorize] attribute on the api controller to avoid the end-user adding more data