Add ApiUser class and permission check