You need to verify that the user is authorized to hit this route, look at bills and supplies for examples.