Added authorization attributes to web api.